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CONQUEST  Quarterly  Progress  Report  #1  for  the  Period 
2  September  2016  -  1  December  2016  (3  Months) 


Section  A.  Task  Progress 

Task  1.1:  QKD  operation  and  security  analysis  for  a  naval  atmospheric  link  with  a 
realistic  eavesdropper 

The  slides  attached  to  this  report  provide  an  update  regarding  Task  1  progress. 

Task  2.1:  Maritime-implementable  QKD  protocols 

General  security  proof  of  discrete-modulation  CV  QKD 

Saikat  Guha  has  been  in  discussions  with  Kamil  Bradler  of  CipherQ  Corp.  on  extending  the  proof 
technique  of  Lutkenhaus  et  ah,  PRA  79,  012307,  which  proved  security  and  a  rate  lower  bound  for 
a  binary-input  (BPSK)  CV  QKD  protocol.  The  main  challenge  in  extending  this  proof  technique 
to  an  M-ary  is  that  this  requires  us  to  retain  the  entire  relative  "geometry"  of  the  M  purifications 
of  the  Eve's  states  (i.e.,  M  choose  2  inner  products).  We  are  investigating  a  way  where  we  could 
argue  that  the  symmetry  of  the  transmitted  ensemble  (e.g.,  a  M-ary  PSK  constellation)  is  preserved 
in  the  symmetry  of  a  particular  purification  of  Eve's  conditional  states,  which  lets  us  proceed  with 
evaluating  bounds  to  conditional  entropies  using  only  a  few  parameters  that  describe  that 
geometry,  and  in  turn  will  hopefully  lead  to  a  rate  lower  bound  with  a  simple-to-implement  key 
map  that  only  has  a  few  quantities  that  Alice  and  Bob  need  to  estimate  during  the  channel 
estimation  step. 

Better  post-processing  for  BPSK  CV  QKD  in  lieu  of  slightly-reduced  rate 

Saikat  Guha  and  Masahiro  Takeoka  has  been  working  on  the  attached  draft  [BPSKCVQKD.pdl]  - 
-  of  work  being  done  in  collaboration  with  Hari  Krovi  and  Norbert  Lutkenhaus  —  on  simple  post¬ 
processing  schemes  for  BPSK  QKD  protocols  (much  smaller  communications  overhead  at  the 
expense  of  slightly  reduced  rate,  but  yet  with  the  optimal  linear  rate-transmittance  scaling),  and 
also  a  new  rate-upper-bound  proof  that  establishes  the  optimal  rate  attainable  with  a  2-state  QKD 
protocol  with  heterodyne  detection. 

Task  3:  Maximizing  the  information  efficiency  of  QKD 

Floodlight  Quantum  Key  Distribution  (FL-QKD):  Theory 

(1)  We  have  completed  an  analysis  of  FL-QKD  using  K-ary  phase-shift  keying  (K-PSK)  and 
quadrature  amplitude  modulation  (QAM)  ,  thus  generalizing  from  our  initial  work  on  binary 
PSK.  For  the  fiber  channel,  K-PSK  allows  the  secret-key  rate  (SKR)  against  the  optimum 
collective  attack,  to  be  doubled,  but  QAM  beyond  4-ary  (which  is  the  same  as  4-PSK),  offers  no 
advantage.  A  conference  paper  on  this  work  will  be  submitted  to  CLEO  2017  this  month,  and  a 
journal  article  is  in  preparation. 
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(2)  We  are  continuing  to  work  on  the  coherent-attack  security  of  FL-QKD  and  hope  to  complete  a 
security  proof  and  SKR  assessment  during  the  next  quarter. 

(3)  The  preceding  theory  was  done  for  a  quiescent  channel,  e.g.,  optical  fiber.  In  previous  work 
on  another  program  we  have  done  some  analysis  of  FL-QKD  for  the  atmospheric  channel,  and  we 
are  beginning  to  extend  that  work. 

Floodlight  Quantum  Key  Distribution  (FL-QKD):  Experiment 

(1)  We  have  previously  perfonned  a  table-top  proof-of-principle  FL-QKD  experiment  that 
demonstrated  a  55  Mbps  SKR  using  100  Mbps  binary  PSK  on  a  channel  with  10  dB  of  attenuation 
(equivalent  of  50  km  of  optical  fiber).  That  experiment’s  modulation  rate  (and  hence  its  SKR) 
were  limited  by  the  capabilities  of  the  equipment  on  hand  at  that  time.  We  have  now  acquired  the 
equipment  needed  to  run  a  table-top  experiment  at  a  10  Gbps  modulation  rate,  and  we  are 
proceeding  to  perfonn  an  FL-QKD  experiment  that  should  achieve  a  1  to  2  Gbps  SKR  on  a  channel 
with  10  dB  of  attenuation. 

(2)  We  are  working  to  implement  a  field-programmable  gate  array  (FPGA)  implementation  for 
our  FL-QKD  system’s  servo  control,  which  will  be  a  great  convenience  for  future  experiments. 

Task  4:  Improved  hardware-domain  signal  processing 

Photonic  Integrated  Circuit  Work 

We  have  demonstrated  high-speed  polarization-encoded  QKD  using  silicon  photonic  integrated 
devices.  The  QKD  transmitter  is  a  polarization-dependent  Mach-Zehnder  modulator  designed  on 
a  CMOS-compatible  silicon-on-insulator  photonics  platform.  The  transmitter  generates  arbitrary 
polarization  qubits  at  gigahertz  bandwidth  with  an  extinction  ratio  better  than  30  dB  at  1480  nm 
using  high-speed  carrier-depletion  phase  modulators.  We  tested  the  performance  of  this  device  in 
a  104m  field  test  between  two  different  buildings  at  MIT.  The  experiment,  done  with  a  clock  rate 
of  62.5  MFIz,  generated  secret  keys  at  a  rate  of  623.3  kbps  along  with  a  bit  error  rate  of  1 .77%  and 
a  phase  error  rate  of  0.67%.  We  are  currently  implementing  further  protocol  improvements,  such 
as  asymmetric  basis  selection  and  faster  clock  rate,  to  bring  the  secret  key  rate  well  into  the  Mbps 
range.  The  work  shows  the  potential  of  using  advanced  photonic  integrated  circuits  to  enable  high¬ 
speed  quantum-secure  communications. 

Task  5:  QKD  network  via  un-trusted  quantum  nodes 

Non-deterministic  amplifiers  for  use  as  quantum  repeaters  for  CV  QKD 

Boulat  Bash  and  Saikat  Guha  are  investigating  the  efficacy  of  using  NLAs  for  quantum  repeaters 
for  CV-QKD  —  an  idea  recently  put  forth  by  Tim  Ralph  and  collaborators.  We  have  explicitly 
evaluated  the  rate  performance  afforded  by  a  single  NLA  repeater  station,  implemented  using  the 
"quantum-scissors"  based  approach.  A  detailed  calculation  has  been  carried  out  of  the  post- 
selected  state  at  the  end  between  Alice  and  Bob,  and  the  probability  of  success  associated  with 
that.  We  have  found  —  from  calculating  the  reverse  coherent  infonnation  of  that  heralded 
entangled  state,  and  accounting  for  the  heralding  probability  —  that  there  is  no  improvement  over 
the  TGW  bound  using  this  one-station  NLA  repeater  approach.  This  does  not  yet  prove  this  does 
not  work,  but  it  suggests  we  may  need  either  (a)  more  repeater  nodes,  or  more  likely  (b)  some 

3  |  Page 

Approved  for  public  release;  distribution  is  unlimited.  This  document  ©2016  Raytheon  BBN  Technologies 

does  not  contain  technology  or  technical  data  controlled  under  either  the  U.S. 

International  Traffic  in  Arms  Regulations  or  the  U.S.  Export  Administration  Regulations. 


form  of  cross-channel  multiplexing,  for  this  to  beat  the  TGW  bound.  There  is  no  known  fonn  of 
CV  QKD  quantum  repeater  that  is  known  to  beat  the  TGW  bound  (upper  bound  on  the  rate  of  the 
best  direct-transmission  QKD  protocol).  We  are  working  on  both  of  those  directions. 

Task  6:  Important  technical  issues  to  address  current  deficiencies  in  the 
theory/practice  of  QKD 

Exploring  novel  non-Gaussian  receivers  for  CV  QKD  for  better  finite-key  performance 

Saikat  Guha  and  Zachary  Dutton  have  been  exploring  the  perfonnance  of  the  Bondurant  receiver 
for  demodulating  the  coherent-state  M-ary  PSK  alphabet.  The  Bondurant  receiver  works  using  a 
conditional-nulling  strategy,  a  style  of  optical  receiver  implemented  by  the  BBN  group  earlier 
[Nature  Photonics  6,  374-379  (2012)].  In  prior  work  funded  by  the  InPho  program,  the  BBN  team 
had  shown  that  the  generalized  Bondurant  receiver  can  attain  a  factor  of  4  improvement  in  the 
error  probability  exponent  of  demodulating  M-ary  PSK  (or  for  that  matter  any  M-ary  coherent 
state  alphabet).  We  have  now  found  that  that  improved  demodulation  error  exponent  translates 
into  better  finite-length  rate  performance.  We  have  derived  a  semi-analytic  expression  for  the  full 
transition  matrix  of  the  generalized  Type-I  Bondurant  receiver  for  demodulating  M-ary  PSK,  and 
translated  that  to  calculating  capacity  and  dispersion  (latter  quantifies  the  finite-length  rate).  So 
far,  we  have  completed  an  analysis  of  the  finite-length  rate  performance  improvement  afforded  by 
the  generalized  Bondurant  receiver  for  classical  communication  (just  the  I(A;B)  tenn,  not  yet  the 
\chi(B;E)  tenn,  which  in  turn  will  complete  the  full  secret-key  rate  calculation).  We  intend  to  write 
this  up  as  a  paper  soon,  and  then  extend  the  analysis  to  key  rate.  We  expect  that  this  receiver  or 
some  variant  of  it  will  improve  the  finite-key-length  performance  of  discrete  modulation  CV  QKD 
protocols.  Details  attached  in  the  short  memo. 

The  LSU  team  has  been  investigating  finite-energy  bounds  on  QKD  protocols.  To  this  end,  we  had 
thought  a  paper  of  Ryo  Namiki  would  be  useful  for  this  purpose  since  there  was  a  claim  that  it  was 
possible  to  use  CV  teleportation  to  simulate  a  pure-loss  channel  of  a  lower  transmissivity  with  one 
having  a  higher  transmissivity.  Upon  further  inspection  of  Namiki's  paper,  we  found  that  there  is 
an  error  and  so  we  are  thinking  of  alternative  methods  for  devising  finite-energy  bounds. 

The  LSU  team  has  devised  a  measure  of  quantum  steering  that  uses  conditional  mutual  information 
and  which  we  call  intrinsic  steerability.  We  proved  several  properties  of  this  measure  that  establish 
it  as  a  steering  monotone.  We  suspect  that  it  will  find  applications  in  one-sided  device  independent 
quantum  key  distribution  as  a  bound  on  secret  key  rates  achievable  in  that  setting. 

Takeoka  and  the  LSU  team  determined  the  optimal  Fisher  information  when  estimating  the  excess 
noise  in  a  thermal  channel  with  a  fixed  transmissivity.  This  should  be  useful  for  estimation  of 
excess  noise  in  quantum  key  distribution  protocols. 

Section  B.  Planned  Activities/Schedule 

A  program  kickoff  meeting  was  held  at  BBN  on  October  7th  with  all  team  members  in 
attendance.  See  attached  slides  from  kick-off  meeting.  Monthly  team  meetings  have  been 
scheduled  and  the  last  monthly  meeting  was  held  via  teleconference  on  November  23rd.  The 
next  scheduled  team  meeting  will  be  held  at  MIT  on  December  15th.  BBN’s  internal  team 
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meetings  are  scheduled  for  every  other  Tuesday  morning.  For  information  regarding  planned 
technical  activities,  see  the  updates  provided  in  Section  A  above. 

Section  C.  Equipment  Purchased 

No  equipment  has  been  purchased  or  constructed  at  this  time. 


Section  D.  Key  Personnel 

There  have  been  no  changes  in  personnel. 


Section  E.  Accomplishments 

See  updates  provided  in  Sections  A  and  B  above  and  in  both  attachments  -  program  slides  and  two 
memos  -  entitled,  “Binary  modulated  CV  QKD:  simplified  post-processing  at  the  expense  of  small 
reduction  in  rate,  and  optimal  post  processing  that  meets  rate  upper  bound”  and  “Capacities  and 
coding  efficiencies  for  the  Sequentual  Waveform  Nulling  with  phase  shift  keying  modulation.” 

Section  F.  Anticipated  Problems 

There  are  no  anticipated  problems  or  issues  to  report  at  this  time. 

Section  G.  YR1  CONQUEST  Budget 


'  Plan  Actuals  Funded 
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Binary  modulated  CV  QKD:  simplified  post-processing  at  the  expense  of  small 
reduction  in  rate,  and  optimal  post  processing  that  meets  rate  upper  bound 

Masahiro  Takeoka1,  Saikat  Guha2,  Hari  Krovi2,  and  Norbert  Liitkenhaus3 

1  National  Institute  of  Information  and  Communications  Technology,  Koganei,  Tokyo  184-8795,  Japan 

2  Quantum  Information  Processing  Group,  Raytheon  BBN  Technologies,  Cambridge,  MA  02138,  USA 

3  Institute  for  Quantum  Computing,  University  of  Waterloo,  Waterloo  ON,  N2L  SGI,  Canada 

(Dated:  December  1,  2016) 

Continuous  variable  (CV)  quantum  key  distribution  (QKD)  has  a  practical  advantage  in  its  imple¬ 
mentation  since  it  can  use  conventional  optical  telecom  components,  and  does  not  require  cryostats 
to  support  good-quality  single  photon  detectors  required  for  discrete  variable  QKD  protocols.  On 
the  other  hand,  one  of  CV  QKD’s  practical  drawbacks  is  the  highly  complicated  signal  modula¬ 
tion  and  classical  post  processing  of  the  output  of  the  heterodyne  detector,  and  the  associated  low 
transmission  ranges  due  to  electrical  noise  bandwidth  limitations  of  the  detector.  In  this  paper,  we 
extend  the  binary  phase  shift  keyed  (BPSK)  CVQKD  protocol  investigated  in  Zhao  et  al.,  Phys. 

Rev.  A  79,  012307  (2009)  in  two  ways.  First,  we  show  that  the  post  processing  protocol  described 
in  the  above  paper  is  optimal  in  the  sense  that  it  achieves  the  secret-key-generation  capacity  (with 
unlimited  two-way  public  authenticated  communication)  of  a  pure-loss  bosonic  channel  under  the 
constraints  of  the  BPSK  coherent-state  alphabet  and  heterodyne  detection.  Second,  we  propose  a 
suite  of  simplified  post  processing  protocols  which  attain  slightly  suboptimal  key  rate  performance 
while  greatly  reducing  the  cost  of  post  processing  and  classical  communication. 


I.  INTRODUCTION 

Quantum  key  distribution  (QKD)  is  a  protocol  to  share 
secret  key  between  two  distant  parties  Alice  and  Bob  such 
that  the  key  is  provably  secure  against  an  eavesdrop¬ 
per,  Eve,  who  has  unlimited  eavesdropping  technology 
allowed  by  quantum  mechanics.  QKD  is  now  not  only 
with  a  scientific  interest  but  also  emerging  as  a  prac¬ 
tical  technology  and  has  been  implemented  in  the  field 
testbeds  around  the  world  [1-4]. 

Many  of  the  QKD  protocols  rely  on  single  photon  de¬ 
tector  [5]  which  is  technically  a  hard  part  and  often  limits 
the  practical  performance  and  cost  of  the  system.  Al¬ 
ternative  protocols  are  called  continuous  variable  QKD 
(CVQKD)  where  the  information  from  Alice  is  encoded 
in  the  quadrature  of  optical  field  and  is  detected  by 
quadrature  measurements  such  as  homodyne  or  hetero¬ 
dyne  detectors  at  Bob’s  side.  The  practical  advantage 
of  CVQKD  is  that  their  detectors  are  commonly  used  in 
conventional  optical  communication  and  thus  one  can  use 
off-the-shelf  technologies  developed  in  that  field.  On  the 
other  hand,  the  drawbacks  are  complications  of  the  quan¬ 
tum  signal  modulation  and  the  classical  postprocessing. 
A  standard  CVQKD  protocol,  known  as  the  GG02  proto¬ 
col  [6] ,  uses  coherent  state  modulated  in  phase  space  with 
continuous  Gaussian  distribution  which  is  more  compli¬ 
cated  than  the  discrete  modulations  used  in  other  QKD 
protocols.  In  addition,  the  measured  data  is  also  contin¬ 
uously  distributed  which  should  be  properly  discretized 
and  processed  at  the  classical  postprocessing  step.  This 
makes  another  complication  (mostly  at  error  correction) 
in  practical  systems. 

Another  practical  problem  is  the  data  length  at  the 
key  distillation  step.  In  single  photon  detection  based 
QKD,  photon  detection  probability  at  Bob  is  propor¬ 


tional  to  the  channel  transmittance,  which  is  very  small 
for  long  distance  channels.  Since  only  the  photon  de¬ 
tected  outcomes  are  distilled  for  the  final  key  generation, 
the  amount  of  data  used  at  the  key  distillation  is  much 
smaller  than  the  number  of  pulses  originally  sent  from 
Alice.  In  CVQKD  on  the  other  hand,  since  the  detec¬ 
tion  outcomes  are  continuous  values  of  quadratures,  all  of 
the  measured  outcomes  must  be  used  for  the  distillation 
process.  This  makes  the  distillation  process  of  CVQKD 
more  complicated  than  that  of  the  single  photon  detec¬ 
tion  based  QKDs. 

One  possibility  to  overcome  these  techinical  issues  is  to 
consider  discretely  modulated  CVQKD  using  for  exam¬ 
ple  binary  phase  shift  keyed  (BPSK)  modulation  [7-9]. 
The  reason  that  Gaussian  modulation  is  more  commonly 
used  than  the  discrete  modulation  is  of  its  security  as¬ 
pect.  Since  discretely  modulated  signal  ensembles  has 
non-Gauissian  statistics,  the  security  proof  of  the  dis- 
cretly  modulated  CVQKD  becomes  nontrivial  and  com¬ 
plicated.  However,  regardless  of  this  complication,  the 
lower  bound  of  the  achievable  key  rate  against  collective 
attacks  for  the  BPSK  modulation  has  been  shown  for  a 
pure-loss  channel  [8]  and  later  for  general  channels  [9]. 

In  this  paper,  we  extend  the  BPSK  CVQKD  protocol 
proposed  in  [8,  9]  and  further  investigate  its  postprocess¬ 
ing  part  toward  establishing  the  QKD  protocol  benefit¬ 
ing  all  the  above  practical  advantages.  More  precisely,  we 
pursue  the  QKD  protocol  with  the  minimum  postprocess¬ 
ing  cost  whereas  keeping  the  merits  of  off-the-shelf  optical 
technologies  and  simple  signal  modulation  format.  Fig¬ 
ure  1  summarizes  the  steps  of  the  classical  postprocessing 
of  the  BPSK  CVQKD  in  [9].  After  measuring  the  quan¬ 
tum  signals  and  storing  continuous  variable  measurement 
outcomes,  Alice  and  Bob  do  channel  estimation  by  usnig 
a  part  of  the  data  and  then  sifting  the  keys  (if  necessary). 
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FIG.  1:  Classical  postprocessing  in  continuous  variable  quan¬ 
tum  key  distribution.  EC:  error  correction.  PA:  privacy  am¬ 
plification. 


The  sifted  key  Y  is  then  mapped  to  two  variables  Y  and 
U  where  the  former  is  the  discretized  data  used  for  the 
key  distillation  and  the  latter  is  publically  announced  to 
Alice  which  contributes  to  increase  the  mutual  informa¬ 
tion  (and  thus  the  final  key  rate)  between  Alice  and  Bob. 
Throughout  the  paper,  we  refer  the  process  Y  — >  (Y ,  U) 
as  the  key  map. 

Our  paper  has  two  main  contributions.  First,  we  prove 
that  the  key  map  in  Zhao  et  al.’s  protocol  [9]  is  optimal 
in  the  sense  that  it  achieves  the  capacity  of  a  pure-loss 
bosonic  channel  under  constraint  of  the  physical  setting 
of  the  BPSK  CVQKD.  In  addition,  as  a  minor  result,  we 
propose  the  “efficient”  version  of  Zhao  et  al.’s  protocol  by 
using  the  idea  of  the  efficient  protocol  proposed  for  BB84 
protocol  [10].  This  protocol  can  improve  the  key  rate  and 
also  does  not  require  active  switching  of  the  detectors. 
Second,  we  propose  simpler  key  maps  reducing  the  cost  of 
classical  processing  and  communication  whereas  keeping 
suboptimal  key  rate  performance  in  a  pure-loss  bosonic 
channel.  We  believe  the  results  contribute  a  way  toward 
developing  a  provably  secure  CVQKD  protocol  taking  the 
advantages  of  optical  communication  components,  simple 
signal  modulation,  and  simple  classical  postprocessings. 


II.  EFFICIENT  BPSK-CVQKD  PROTOCOL 

In  this  section,  we  revisit  the  BPSK-CVQKD  proto¬ 
col  proposed  in  [8,  9]  and  consider  its  “efficient”  version. 
We  consider  only  the  asymptotic  limit  of  the  inifnitely 
long  key  exchanges.  Alice  picks  a  binary-valued  ran¬ 
dom  variable  X  £  {0, 1}  with  equal  probabilities,  and 
transmits  one  of  the  two  BPSK  coherent  state  pulses 
| cxx)a  €  { | — ck) ,  |a)},  x  =  0, 1,  with  a  £  R,  \a\2  =  n  to 
Bob  through  the  quantum  channel.  While  Bob’s  receiver 
is  assumed  to  be  a  heterodyne  receiver  in  [9],  we  replace 
it  with  the  asymmetric  heterodyne  receiver  meaning  that 
the  signal  pulse  is  split  via  an  asymmetric  (non-50/50) 
beamsplitter  with  transmittance  tjbs  >  0-5  and  then  the 
real  quadrature  of  the  transmitted  signal  and  the  imagi¬ 
nary  quadrature  of  the  reflected  signal  are  measured  by 
homodyne  detectors.  This  asymmetric  detection  is  simi¬ 
lar  to  the  idea  of  the  “efficient”  protocol  in  BB84  [10]  and 
contributes  to  gain  the  key  rate.  In  the  limit  of  infinitely 
long  pulse  sequence,  the  channel  estimation  is  possible 


even  taking  773s  — ►  1- 

Let  Y  be  the  strings  of  the  sifted  key,  i.e.  the  mea¬ 
surement  outcome  of  the  real  quadrature  after  sifting  the 
signals  used  for  channel  estimation.  After  the  channel  es¬ 
timation,  Bob  performs  the  key  map  which  maps  a  string 
of  y  to  announcement  u  and  discretized  key  y.  The  an¬ 
nouncement  is  publically  announced  to  Alice  to  help  her 
key  distillation  process.  Then  Alice  and  Bob  do  the  error 
correction  and  the  privacy  amplification  to  distill  the  key 
from  (X,  Y)  conditioned  on  U.  The  key  map  particularly 
considered  in  [9]  is  u  =  \y\  and  y  is  the  sign  of  y  which 
we  call  the  infinite  discretized  key  map. 

In  the  following,  we  consider  a  specific  scenario  such 
that  the  channel  is  estimated  to  be  a  pure-loss  channel 
with  transmittance  77  £  (0,1].  In  addition,  we  assume 
that  the  quantum  devices  in  Alice  and  Bob’s  sides  do  not 
have  any  imperfection  and  also  they  can  perform  ideal 
error  correction  and  privacy  amplification.  Two  reasons 
for  choosing  this  scenario:  1)  it  simplifies  the  key  rate 
analysis,  and  more  importantly,  2)  in  a  pure-loss  channel, 
we  can  prove  the  optimality  of  the  infinite  discretized 
key  map  in  the  sense  that  it  achieves  the  capacity  of  the 
efficient  BPSK-CVQKD  protocol  in  this  channel.  The 
rigorous  statement  of  the  capacity  and  its  proof  will  be 
given  in  Sec.  IV. 

In  the  limit  of  773s  h ►  1  with  the  above  assumption,  the 
conditional  probability  of  Bob’s  measurement  outcome  y 
is  given  by  p{y\X  =  0)  =  p(y\0)  =  -Le-^-^*2  and 

p(y\X  =  1)  =  p{y\l)  =  Under  these 

assumptions,  the  key  rate  lower  bound  against  collective 
attacks  with  the  infinite  discretized  key  map  is  obtained 
from  [9]  by  taking  zero  excess  noise.  It  is  given  by 


i?(oo)  : 


dyf(y ) 


1  —  h{ty)  —  h 


1  +  K 


+h 


1  +  v/l-4ey(l-ey)(l-K2) 


,(1) 


where  f(y)  =  p(y\0)  +  p(y\l),  ey  =  p(„|gffp(„|1)  = 

i+e*Vvfi\y\ )  and  k  =  e~2(-1~v^n.  The  key  rate  in  (1)  max¬ 
imized  over  n  gives  the  achievable  rate  of  the  BPSK- 
CVQKD  with  the  infinite  discretized  key  map.  With  this 
key  map,  Bob  ideally  announces  the  continuous  value 
u  =  \y\  to  Alice  via  a  public  channel  which  costs  ad¬ 
ditional  classical  information  transmission.  In  practice, 
|y|  should  be  discretized.  The  amount  of  classical  in¬ 
formation  for  U  is  therefore  approximately  given  by  m 
bits/pulse  for  2m  discretization. 

As  we  mentioned,  the  key  rate  in  Eq.  (1)  is  indeed  the 
capacity  of  the  efficient  BPSK-CVQKD  in  a  pure-loss 
channel,  that  is,  the  infinite  discretized  key  map  is  the 
best  strategy  to  maximize  the  key  rate  under  the  fixed 
physical  setup  of  the  efficient  BPSK-CVQKD. 
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III.  SIMPLIFIED  KEY  MAPS 

In  this  section,  we  propose  two  simplified  key  maps 
for  the  BPSK-CVQKD.  Although  the  infinite  discretized 
key  map  is  optimal  for  maximizing  the  key  rate,  the  cost 
for  the  classical  processing  and  communication  could  be 
large  since  the  announcement  U  should  be  continuous 
variable  in  ideal.  Our  simplified  key  maps  can  reduce  the 
classical  cost  significantly  whereas  keeping  the  subopti- 
mality  of  the  achievable  key  rates.  Again,  for  simplicity, 
we  calculate  the  achievable  key  rate  under  the  assump¬ 
tions  that  the  quantum  channel  between  Alice  and  Bob  is 
estimated  to  be  a  pure-loss  channel  and  Eve’s  attacks  are 
restricted  to  be  collective  attacks.  The  key  rate  calcula¬ 
tion  for  each  key  map  is  along  with  [9]  which  we  describe 
in  detail  in  Appendix  for  completeness. 

A.  2-bin  discretized  key  map 

Bob  makes  a  hard  decision,  based  on  the  sign  of  y,  to 
obtain,  Y  £  {0, 1}  and  does  not  send  any  announcement 
to  Alice  (i.e.  U  £  {0})-  Y  is  interpreted  as  an  output  of 
a  binary  symmetric  channel  BSC(e)  with  X  as  the  input 
where  e  =  fn  p(yj0)dy  =  |erfc  (y/rjn).  The  lower  bound 
of  the  key  rate  is  given  by 

RV  >  1  -  h(e)  -  h  (Lp) 

+J1  +  ^1~4e(21~e)(1 (2) 

where  k  =  exp[— 2(1  —  77)77.]  and  h(p)  =  —p\og2(p)  —  (1  — 
p)  log2(l  —  p)  is  the  binary  entropy  function.  This  rate  is 
maximized  over  n  for  each  given  77.  Since  U  £  {0},  Bob 
can  fully  save  the  classical  communication  cost  for  the 
announcement . 


FIG.  2:  Key  rates  for  various  CV  QKD  protocols. 


where 

-  =  _ 1  -  erf  (y/pn  +  5th) _ 

2  +  erf  (y/rjfi  -  <5th)  -  erf  (y/rjfi  +  <5th) 

Again,  the  above  key  rate  is  maximized  over  fi  for  each 
given  77.  In  this  key  map,  we  have  a  freedom  to  choose 
<5th-  In  the  following,  we  consider  three  options:  1)  op¬ 
timize  (5th  such  that  the  key  rate  is  maximized  for  each 
gievn  77,  2)  choose  5th  such  that  Psucc  is  equal  to  rj  and  3) 
choose  5th  such  that  Psucc  is  equal  to  y/p.  The  idea  of  the 
second  option  is  to  mimic  the  success  probability  of  the 
single-photon  based  protocols  such  as  BB84  which  could 
significantly  reduce  the  classical  communication  and  pro¬ 
cessing  cost  for  the  key  distillation.  The  third  option  is 
in  between  1)  and  2). 

In  summary,  the  classical  communication  cost  for  the 
announcement  is  1  bit/pulse  (success  or  failure  informa¬ 
tion)  and  that  for  the  key  distillation  depends  on  the 
choice  of  5th- 


B.  3-bin  discretized  protocol 


C.  Key  rate  comparison 


Next  simplest  is  the  3-bin  discretization.  Bob  makes 
a  two-step  decision:  first  assign  U  =  {0,1}  for  { |j/|  > 
5th 5  \y\  <  5th}  where  5th  is  a  positive  threshold  parameter, 
and  u  =  1  is  regarded  as  a  failure  outcome.  That  is, 
by  the  announcement,  Bob  tells  Alice  success  or  failure 
for  each  pulse  which  costs  1  bit /pulse.  For  each  success 
event,  Bob  assigns  y  =  {0, 1}  for  negative  and  positive  y, 
respectively,  and  use  it  to  distill  the  final  keys.  The  key 
rate  is  thus  a  function  of  the  success  probability  PSUCc  = 
\  (2  +  erf  (y/rjn  +  5th)  -  erf  (y/rjn  -  5th))  and  is  given  by 

P(3)  >  Ps 


1  —  h(e)  —  h 


1  +  K 


1  +  y/1  -  4e(l  -  e)(l  -  k2)' 


,  (3) 


Figure  2  plots  the  key  rates  as  a  function  of  channel 
loss  for  2-bin,  3-bin,  and  infinite  discretized  key  maps. 
Also  for  comparison,  the  standard  CVQKD  protocol  with 
Gaussian  modulation  and  actively  switched  homodyne 
detection  also  plotted  [5,  6]  (see  also  [11]  for  a  summa¬ 
rized  key  rate  expression).  There  are  several  observa¬ 
tions.  First,  scaling  of  all  the  key  rates  except  the  3- 
bin  discretized  key  maps  with  Psucc  =  V  and  y/rj  are 
0(y).  This  is  known  to  be  the  optimal  rate- loss  scal¬ 
ing  for  any  point-to-point  QKD  protocols  in  a  pure-loss 
channel  [11  -13].  Second,  the  key  rate  gap  between  the 
Gaussian  CVQKD  and  the  efficient  BPSK-CVQKD  with 
the  infinite  discretized  key  map  is  relatively  small  (fac¬ 
tor  of  3.7  for  small  77).  As  mentioned  in  the  introduc¬ 
tion,  the  efficient  BPSK-CVQKD  has  practical  advan¬ 
tages  compared  to  the  Gaussian-CVQKD  such  as  simple 
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FIG.  3:  Success  probabilities  of  the  3-bin  discretized  key  maps 
with  different  thresholds. 


modification  and  non-necessity  of  active  switching  at  de¬ 
tection.  Third,  moreover,  the  rate  degradation  by  the 
simplification  of  the  key  map  from  infinite  to  2  or  3-bin 
discretizations  in  the  BPSK-CVQKD  is  rather  small  (less 
than  factor  of  1.6)  whereas  the  announcement  cost  is  zero 
(2-bin)  or  1  bit /pulse  (3-bin).  These  observations  show 
the  potential  of  the  BPSK-CVQKD  with  the  simple  key 
maps  as  classical  cost  effective  protocols. 

For  the  3-bin  discretized  key  map,  it  is  observed  that 
the  reduction  of  the  success  probability  clearly  decreases 
the  key  rate  scaling.  In  other  words  the  plots  show  the 
trade-off  between  the  key  rate  scaling  and  the  classical 
data  cost  at  the  key  distillation  step.  In  the  straight 
line  region,  the  key  rates  roughly  scales  as  0(r/1'7)  and 
0(rj13)  for  Psucc  =  77,  and  y/rj,  respectively.  The  length 
of  {y}  processed  at  the  key  distillation  step  depends  on 
the  success  probability  at  the  key  map.  In  Fig.  3,  we 
plot  the  success  probabilities  for  the  different  3-bin  key 
maps.  Even  though  the  rate  scaling  reduces  for  lower 
success  probabilities,  Figs.  2  and  3  still  suggest  the  use¬ 
fulness  of  the  non-optimal  3-bin  key  map.  For  example, 
comparing  the  3-bin  key  map  with  Psucc  =  yj rj  by  the 
inifinite  discretized  key  map  at  20dB  losses,  the  key  rate 
of  the  former  is  42%  of  the  latter  whereas  the  length  of 
y  to  be  distilled  for  the  former  reduces  to  only  6%  of  the 
latter.  That  is,  with  the  3-bin  key  map  with  Psucc  =  yff\, 
while  the  obtainable  key  rate  reduces  to  2/5  of  the  best 
key  rate  in  the  efficient  BPSK  CVQKD,  one  can  com¬ 
press  the  necessary  data  length  for  the  key  distillation 
less  than  1/16  of  the  original  signal  length  n. 


IV.  PROOF  OF  THE  UPPER  BOUND 

In  this  section  we  provide  a  rigorous  proof  of  the  op¬ 
timality  of  the  infinite  discretized  key  map.  The  precise 
statement  of  our  capacity  theorem  is  as  follows. 

Theorem  1  The  secret  key  capacity  of  the  lossy  bosonic 


channel  of  transmissivity  77,  under  constraint  of  (a) 
BPSK  coherent  state  transmission  of  mean  photon  num¬ 
ber  h,  and  (b )  asymmetric  heterodyne  measurement  used 
at  the  receiver,  is  given  by: 


C 


BPSK 


dyf{y) 


1  —  h(ey)  —  h 


1  +  K 


+h 


1  +  y/l  -  4ey{l  -  ev){l  -  k2) 


,(5) 


where  f(y)  =  p(y |0)  +  p(y |1)  and  e: 
1 

l_(_e4xA7^|?/l  ' 


pfalo) 

p(j/|0)+p(y|l) 


Proof.  Due  to  the  constraints  (a)  and  (b),  after  the 
transmission  of  the  BPSK  signals  and  detection  via  an 
asymmetric  heterodyne  receiver  with  ?7bs  — ►  1,  Alice, 
Bob,  and  Eve  share  copies  of  cog-state: 


Pxye  =  ^2  dypx(x)pY\x(y \x)\x){x\x 

x 

®ls/)(j/|y  ®  \Tx){Tx\e,  (6) 

where  X  £  {0, 1},  Y  is  a  continuous  variable 

with  pY\x(y\0)  =  -j^e-fo-V2^)2  and  pY\x{y\l)  = 
D=e-(y+v/shd2,  and  £  {±\/l  —  pa};x  =  0,1.  Also 
it  is  easy  to  show  that  px{ 0)  =  pxiX)  =  1/2  maximizes 
the  key  rate.  Thus  the  secret  key  capacity  corresponds  to 
the  maximum  key  rate  extractable  from  copies  of  pxye- 
The  achievability  is  already  shown  in  (1).  To  prove 
the  converse,  we  use  the  intrinsic  information  quantity 
which  was  shown  to  be  an  upper  bound  to  the  maximum 
extractable  key  rate  from  i.i.d.  multiple  copies  of  a  tri¬ 
partite  shared  quantum  state  pabe  [14]. 


I{A-  B  IE)P  =  inf  I(A-B\E')p,  (7) 


where  I(A\  B\E')P  is  the  quantum  conditional  mutual 
information  of  state  pabe1  and  the  infimum  is  taken 
over  all  completely  positive  trace  preserving  maps  A e-¥E‘ 
from  E  to  E'  where  pabe'  =  {Iab®  Ae^e'){pabe)-  We 
may  choose  the  map  Ke^e'  as  the  identity  operation,  to 
give  us  a  (potentially  loose)  upper  bound. 

Then  applying  it  to  our  pxye  in  Eq.  (6),  we  get  the 
upper  bound  of  the  secret  key  capacity  as 

CfPSK  <  I{X;Y\E)p 

=  H(XE)p  +  H(XE)p  —  H(XYE)p  —  H(E)p, 

(8) 


where  H{X)p  is  the  von  Neumann  entropy  of  the  state 
Px-  Pxe ,  Px e  j  Pe  are  the  reduced  density  matrices  of 
Pxye-  The  reduced  density  matrices  and  the  von  Neu¬ 
mann  entropies  are  calculated  as  follows: 


Pye 


dypx(x)pY\x{y\x)\y){y\ 


/  dyf(y)\y){y\Y 

JO 

®  KItoXtoI  +  (1  -  eJ/)l7i)(7i|}£; , 


(9) 
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where  f(y)  =  Pr\x{y\0)  +  Py\x(v\0  and  ey  = 

- i  which  implies 

PY\x(y\o)+PY\x(y\i)  ’  ^ 


POO 

H(YE)p  =  H(Y)P+  /  dyf(y) 
Jo 


xh 


1  +  yJl-A€y{l  -ey)(i-K2) 


(10) 


where  k2  =  |(7o|7i)|2  =  e  ?7^n.  Similarly, 


Pxe  =  2 d0)^0!^  ®  I7o)(7o|b  +  |l)(l|x  <S>  |7i)(7i|b)> 

(11) 

H(XE)p  =  h(  1/2)  =  1.  (12) 


leading  to: 


Similarly, 


Pe  =  ^(|7o)(7o|b  +  |7i)(7i|s), 


(13) 


leading  to: 


H(E)p  =  h 


1  +  K 


(14) 


Finally, 


H(XYE)P  =  1  +  H{Y)p. 


(15) 


Substituting  these  into  Eq.  (8),  we  obtain  the  upper 
bound 


pOO 

CfPSK  <  /  dyf(y) 
Jo 


1  —  h(ey)  —  h 


1  +  K 


+h 


1  +  v/l-4e„(l-  ey)(l-  k2) 


V.  CONCLUSIONS 


In  this  paper,  we  extend  the  BPSK  CVQKD  protocol 
proposed  in  [8,  9]  and  investigate  the  minimum  postpro¬ 
cessing  cost  whereas  keeping  the  merits  of  off-the-shelf 
optical  technologies  and  simple  signal  modulation  for¬ 
mat  of  the  BPSK  CVQKD.  Frist,  we  have  proved  that 
the  key  map  in  Zhao  et  al.’s  protocol  [9]  is  optimal  in  the 
sense  that  it  achieves  the  capacity  of  a  pure-loss  bosonic 
channel  under  constraint  of  the  physical  setting  of  the 
BPSK  CVQKD.  Also,  we  propose  the  “efficient”  version 
of  Zhao  et  al.’s  protocol  as  a  CVQKD  version  of  the  effi¬ 
cient  BB84  protocol  proposed  in  [10].  This  protocol  can 
improve  the  key  rate  while  not  requiring  active  switching 
of  the  detectors.  As  a  second  contribution,  we  have  pro¬ 
posed  simpler  key  maps,  the  2-bin  and  3-bin  discretized 
key  maps,  and  show  that  they  keep  suboptimal  key  rate 
performance  in  a  pure-loss  bosonic  channel  while  reduc¬ 
ing  the  cost  of  key  map  and  annoucement  in  classical 
post  processing.  In  addition,  we  point  out  that  in  the 
3-bin  discretized  key  map,  it  is  even  possible  to  reduce 
the  classical  communication  cost  for  the  error  correction 
and  privacy  amplification  step  which  has  been  one  of  the 
technical  drawbacks  in  CVQKD.  We  show  a  tradeoff  be¬ 
tween  the  key  generation  rate  and  the  failure  probability 
of  the  key  map  where  the  latter  contributes  to  reduce  the 
data  length  for  the  error  correction  and  privacy  ampli¬ 
fication.  Depending  on  the  channel  and  other  technical 
conditions,  one  can  design  appropriate  threshold  for  the 
key  map. 

The  results  shown  here  are  useful  toward  developing  a 
CVQKD  protocol  taking  the  advantages  of  optical  com¬ 
munication  components  as  well  as  simple  signal  modula¬ 
tion  and  classical  postprocessings.  The  remaining  impor¬ 
tant  task  is  to  develop  a  security  proof  and  tight  key  rate 
lower  bound  applicable  to  arbitrary  quantum  channel. 
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Appendix:  Achievable  key  rates  for  the  efficient 
BPSK-CVQKD  with  the  2-bin  and  3-bin  discretized 
key  maps 

In  this  appendix,  we  describe  detailed  derivation  of 
the  key  rate  lower  bound  for  the  efficient  BPSK-CVQKD 
with  2-bin,  and  3-bin  key  maps. 

Our  security  analysis  follows  the  one  in  [9]  based 
on  [15,  16],  but  assuming  a  pure-loss  bosonic  chan¬ 
nel.  As  usual,  we  consider  the  (virtual)  entanglement 
protocol  in  which  Alice  prepares  the  entangled  state 
^(|0)^l— a)A‘  +  |l),4|a)A')  and  then  sends  system  A' 
to  Bob  through  a  quantum  channel  A '  — >•  B.  We  assume 
that  Eve  can  make  any  purification  on  the  state  shared 
by  Alice  and  Bob,  which  we  denote  as  ipABE- 

In  the  asymptotic  limit  of  long  key  length,  the  secret 
key  generation  rate  R  against  any  collective  attacks  is 
lower  bounded  by  [9], 

R>I(X-Y\U)~  max  I(Y;E\U)p,  (A.l) 

V'ABE 

where  Y  €  0, 1  is  the  sign  of  y  measured  by  Bob  which 
cotains  the  information  about  Alice’s  BPSK  encoding,  U 
is  some  information  announced  from  Bob  to  Alice  (and 
Eve)  via  a  public  channel.  The  second  term  is  a  quantum 
conditional  mutual  information  for  the  ccq  state 

PlJYE  =  \M-b-iUY  W’AB.e)] 

=  X ]p(u^y)\u)(u\u  ®  \y)(y\y  ®  Pev >  (A-2) 

u,y 

where  A4  includes  Bob’s  asymmetric  heterodyne  mea¬ 
surement  B  — >  Y  and  the  key  map  Y  — >  UY. 

Suppose  Bob  obtains  the  distribution  p(y \X  =  0)  = 
p(y\0)  =  Jjb'  V"'‘)3  and  p{y\l)  =  Te“^+'^“^2 
at  the  channel  estimation  step.  This  specifies  that 
Bob’s  conditional  states  before  the  measurement  are 
\±^/rja)(±^/rja\.  Thus  the  purification  held  by  Alice, 
Bob,  and  Eve  should  have  the  following  form: 

\^)abe  =  ^  {\0)A\-y/rja)B\<t>-}E  +  \1)  a\Vv®)  b\<P+)  e)  ■ 

(A-3) 

where  Bob  and  Eve’s  systems  should  preserve  the  inner 
product  of  the  signal  sent  from  Alice: 

|(-a|a)|  =  \{-^/pa\^/ya){(p_\(p+)\.  (A.4) 

This  implies  that 

K<M<£+)I  =  \(-V1~vaW1-  va)\ 

=  exp[— 2(1  —  77)77.]  =  k,  (A. 5) 

where  n  =  |a-|2.  These  observations  uniquely  characterize 
the  optimal  purification. 
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Also,  the  conditional  state  of  (A. 3)  on  Bob’s  hetero¬ 
dyne  measurement  is 


Wv)ae  = 


1 


(e-(VM)2/2|  0)^_)e 


lp2p(y) 

+e-^-y)2/2\1)A\ 0+>B)  ,  (A. 6) 


where 


p(y)  =  2  Cp(y|°)  H-pCyl1)) 


h  (V  ^«+s/)2  +  e-(07«-i/)2^  .  (a. 7) 


2-y/TT 


These  allow  us  to  calculate  the  necessary  entropies: 

/(F;£|C/)#(2)  =  I(Y;E)M2) 

=  H(E)zm-H(E\Y)&a) 

,  /l  + 

=  h 


-h 


'l  + v/l-4e(l-e)(l-K2)' 


(A. 12) 


where  n  is  in  (A. 5)  and  e  =  |erfc  (y/rjn).  Then  from 
(A. 8)  and  (A.  12),  we  have  a  desired  result. 


1.  2-bin  discretized  key  map 

For  the  2-bin  discretized  key  map,  the  effective  channel 
including  a  quantum  channel,  Bob’s  measurement,  and 
the  key  map  is  simply  given  by  a  classical  binary  sym¬ 
metric  channel  with  error  e  =  ^eT{c(y/rjn) .  Since  there  is 
no  announcement  from  Bob,  the  first  term  of  (A.l)  is 

I(X-,Y\U)=I(X-,Y)  =  l~h(e).  (A.8) 

For  the  second  term  of  (A.l),  we  need  to  derive  Eve’s 
state  conditioned  on  Bob’s  outcome  y.  From  (A. 6)  we 
obtain  the  cg-state  held  by  Bob  and  Eve  as 


’I 


^’E  =  J2pY(y)\y)(y\Y®^\ 

y= o 

1  ly®^  +  |l)(l|y®H)  ,  (A.9) 

where  pY( 0)  =  f°  dyp(y)  =  1/2, 


rO 


,y 


^e  =  2  /  dyp(y)VE 

J  —  OO 

i  r° 


dy  (e-(v^“+®)2 \(j>_){<j>_ \E 

+e-^-vr\4>+){<f>+\E) 


2.  3-bin  discretized  key  map 

The  3-bin  discretized  key  map  includes  failure 
events  with  probability  1  —  Psucc  where  Psucc  = 
\  (2  +  erf  (y/rjn  +  <5th)  —  erf  (y7 rjn  —  8th))-  The  effective 
channel  of  a  quantum  channel  and  Bob’s  measurement  is 
then  modeled  by  a  binary  earsure  channel  with  a  sym¬ 
metric  error 


e  = 


1  -  erf  (y/fjn  +  <5th) 


2  +  erf  (y/rjn  -  <5th)  -  erf  (y7 rjn  +  St h) 


(A.13) 


The  conditional  mutual  information  between  Alice  and 
Bob  is  then  calculated  to  be 


I(X-,Y\U)  =  Psucc(l-h(e)). 


(A. 14) 


After  Bob’s  measurement  and  key  map,  Bob  and  Eve 
hold  the  following  ccg-state: 


4> 


(3) 


y= o 


UYE  =  Pt/(0)|0)(0|c/  <8»  (py(0)|0)(0|^  ® 

+Py(l)|l)<l|y  ®^l=1) 

+pE/(l)|l)(l|[/  ®  |2)(2|y  n=1,  (A. 15) 


where 


/— <5th  r  oo 

dyp(y)  +  /  dyp{y) 
-oo  J  <5th 


1  +  erf2(^o)  |»_w_  b  + 

(A.10) 


=  -  (2  +  erf  (y/rjn  +  <5th)  -  erf  (y/rjn  -  <5th)) 


=  P„ 


(A.16) 


Pu(  1)  =  1  -  Psucc,  Py( o)  =  Py(  1)  =  1/2, 


and  similarly 


v— o  _ 


r— 5th 


i  _  1  -  erf  (y^a) 


P 


dyp(y )T 


— 


I  4>-)(4>-\e 


SUCC  J—  OO 
1 


1  +  eri{y/rja) 


2  Pm 


{(1  +  erf(v/r^-  <5th)  )|  </>-)(<£- 1  £ 


I  <P+)(<P+\e-  (A.ll) 


+(1  -  eri (y/rjn  +  <5th))|</>+)(0+b}  >  (A-17) 


and  similarly, 


and  thus  the  second  term  of  (A.l)  turns  out  to  be 


1  =  77W — {(!  -  erf {y/rrn  -  6th))\<j>-) (<£- \e 

succ 

+(1  +  erf (y/rjn  +  (5th))|</>+)(0+b}  ■  (A.18) 
Then  we  have  the  conditional  entropies: 

H(E\U)^3)  =  PauccH{E\u  =  0)^(3) 

+  (1  —  Psucc)H(E\u  =  1)^(3), 

(A.19) 

H{E\UY)%W  =  ^(H(E\u  =  0,y  =  0)*l3) 
+H{E\u  =  0  ,y  =  1)^(3)) 

+  (1  —  Psucc)H(E\'U  =  1)^(3), 

(A. 20) 


I{Y-E\U)^ 


H(E\U)^3)  -  H(E\UY)*m 


(A.21) 


Combining  Eqs.  (A.  14)  and  (A.21),  we  get  the  desired 
result. 


Capacities  and  coding  efficiencies  for  the  Sequentual  Waveform  Nulling  with  phase 
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We  calculate  the  complete  error  transfer  matrix  for  a  sequentual  waveform  nulling  (SWN)  receiver 
applied  to  communication  link  with  M- ary  phase  shift  keying  modulation.  We  use  this  to  calculate 
the  capacity  and  dispersion  as  a  function  of  mean  photon  number  per  pulse,  which  in  tern  gives  us 
the  coding  efficiency  of  the  SWN.  The  results  are  compared  with  heterodyne  detection  as  well  as 
the  optimal  Helstrom  measurement.  As  expected,  we  find  the  reduced  error  rate  of  the  SWN  yields 
a  slightly  improved  capacity  than  heterodyne  when  considering  envelope  defined  by  all  possible  M. 

The  dispersion  comparison  between  different  receivers  is  non-trivial  as  a  function  of  power  per  pulse, 
though  the  SWN  recveiver  shows  a  clear  advantage  over  heterodyne  in  the  useful  operational  range 
of  1  <  N0  <  10. 


Bondurant  [1]  first  proposed  a  receiver  capable  of  beating  the  error  rate  of  coherent  detection  with  a  4-PSK  alphabet, 
based  on  a  sequential  nulling  strategy  in  which  a  LO  mixes  with  the  signal  to  null  out  the  m  =  0  modulation  waveform, 
and  then  successfully  nulls  m  =  1,2,...  as  single  photon  clicks  are  recorded.  This  strategy  was  generalized  in  for  any 
alphabet  [2].  Here  we  focus  on  the  case  of  an  aribtrary  MPSK  alphabet  utilizing  the  same  strategy  as  Bondurant’s 
original  proposal. 

In  particular  we  analyze  the  error  rate  for  M  =  2,4, 8, 16  and  calculate  the  complete  error  transfer  matrix.  Assuming 
M  possible  waveforms,  equally  spaced  in  phase  and  labelled  m  =  0, 1, 2, . . .  M  —  1.  Upon  obtaining  l  clicks  over  the 
course  of  pulse  detection,  the  SWN  receiver  will  guess  l.  The  transition  matrix  elements,  in  the  absence  of  dark 
counts,  are  P(l\m)  =  0  for  all/  >  m.  For  l  <  m: 


pT  pT  pT  pOO 

P(l\m)  =  /  Pm(ti)dt1  /  Pm-i(t2  ~  t1)dt2  ■  ■  ■  /  -ti_i)dti  /  Pm_i(ti+1  -  ti)dtl+i  (1) 

Jti=0  Jt2=ti  j  ti  —ti_i  J tl  + 1 

where  Pk(t)  =  Xke~Xkt  and  A&  =  ( 2N0/T)[l  —  cos(27r k/M)\.  Here  N0  is  the  mean  photon  number  per  pulse  and  T  is 
the  pulse  length.  And  finally  for  l  =  m: 


FIG.  1:  Error  rate  versus  mean  photon  number  for  M  =  8  for  the  SWN  receiver  (blue),  and  compared  with  heterodyne  (red) 
and  Helstrom  limit  (green). 
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FIG.  2:  Shannon  capacities  of  the  SWN  (blue),  Heterodyne  (red)  and  Helstrom  limited  (green)  receivers  for  M  =  2,4,8,  and 
16.  The  dashed  curve  shows  the  Heterodyne  limit  for  an  unconstrained  modulation  format  log2(l  +  No)  while  the  solid  black 
curve  shows  the  Holevo  bound. 
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FIG.  3:  Dispersion  of  the  SWN  (blue),  Heterodyne  (red)  and  Helstrom  limited  (green)  receivers  for  M  =  8. 


P{m\m)  =  f  Pm(ti)dt  i 

J  £i=0 

This  transition  matrix  can  be  used  firstly  to  calculate  the  receiver  error  rate.  The  results  for  M  =  8  are  plotted 
in  Fig.  1.  The  results  for  heterodyne  and  the  Helstrom  limit.  One  sees,  as  expected  that  as  the  photon  number  Nq 
increases,  the  SWN  receiver  beats  heterodyne  and  scales  as  the  Helstrom  limit.  It  actually  performs  worse  thatn 
heterodyne  at  low  photon  number,  with  a  cross  over  between  1  and  10  photons.  Secondly,  we  use  the  transition 
matrix  to  calculate  the  Shannon  capacities.  We  plot  the  cases  M  =  2,4,8, 16  in  Fig.  2.  Each  receiver,  as  N0  increases 
asymptotically  approach  log2(M).  We  see  that  the  envelope  of  the  SWN  receivers  exceeds  the  heterodyne  case  and 
even  exceeds  the  unconstrained  heterodyne  limit  below(the  dashed  curve)  No  <  10.  Above  this  point  using  a  QAM 
modulation  format  becomes  optimal  -  though  we’d  expect  the  SWN  applied  to  this  modulation  would  maintain  its 
advantage. 

Finally,  the  dispersion  is  calculated  using  the  same  transition  matrices.  The  results  for  M  =  8  are  plotted  in  Fig.  3. 
For  dispersion,  a  lower  value  means  a  lower  variance  in  error  rate  which  allows  coding  with  shorter  block  lengths. 
One  sees  the  the  SWN  and  heterodyne  recievers  experience  a  cross  over  just  below  Np  <  1  ,  above  which  the  SWN  is 
superior.  The  capacity  for  a  finite  block  length  code  can  be  calculated  as  C  —  \/H/nErfc_1(2e)  ,  where  Erfc_1(a:)  is 
the  inverse  complementary  error  function  and  e  is  the  targeted  error  rate.  Two  examples  are  shown  in  4. 


Pm-l{t2  ~  t\)dt2 


Pli^m  t'm—l  )dtTi 


(2) 
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FIG.  4:  Capacity  (dotted  curves)  and  finite  block  length  capacity  (solid  curves)  for  the  SWN  and  heterodyne  receivers  versus 
block  length  n.  The  first  plot  shows  M  =  8  at  No  =  0.8  where  the  SWN  has  a  clear  advantage.  The  second  shows  No  =  0.1 
which  is  very  near  the  cross-over  point  where  neither  recievers  has  much  advantage,  e  =  10~6  in  these  plots. 
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